BSD Commit Log Search

   bump the netbsd gcc 14 version due to addition of gfortran support.

   note gfortran appears.

   remove extraneous ref to ``previous job''

   nushell: patch second copy of mio as well

   ensure lock is released when fdset fails

   reviewed by christos@

   usr.bin/sort: Sync the usage message with the manual page.

webkit-gtk, webkit-gtk4: remove some old webkit-gtk versions

No sense in working on these any longer.

webkit-gtk-2.50: move to webkit-gtk

   curl & libcurl-gnutls: fix BUILDLINK_API_DEPENDS.openssl

   The assignment shouldn't be placed in Makefile.common for more than one
   reason (openssl is a build option, it should be propagated to packages
   that link against libcurl, and, though harmless, makes no sense being
   applied to libcurl-gnutls).

   Related to PR pkg/59899. Also likely related to:
   https://mail-index.netbsd.org/tech-pkg/2026/01/16/msg031893.html

   pkg-vulnerabilities: add last 12 hours CVEs

   + assimp (not fixed)

mapnik: Add reference to CVE-2025-15537

py-pywhat: adjust LICENSE path

This likely changed between py-poetry-core versions.

   doc: Updated www/chromium to 144.0.7559.59

   www/chromium: remove workaround flag from wrapper script

   www/chromium: update to 144.0.7559.59

   * 144.0.7559.59

   This update includes 10 security fixes. Below, we highlight fixes that
   were contributed by external researchers. Please see the Chrome Security
   Page for more information.
   [$8000][458914193] High CVE-2026-0899: Out of bounds memory access in V8.
   Reported by @p1nky4745 on 2025-11-08
   [TBD][465730465] High CVE-2026-0900: Inappropriate implementation in V8.
   Reported by Google on 2025-12-03
   [TBD][40057499] High CVE-2026-0901: Inappropriate implementation in Blink.
   Reported by Irvan Kurniawan (sourc7) on 2021-10-04
   [$4000][469143679] Medium CVE-2026-0902: Inappropriate implementation in V8.
   Reported by 303f06e3 on 2025-12-16
   [$3000][444803530] Medium CVE-2026-0903: Insufficient validation of untrusted
   input in Downloads. Reported by Azur on 2025-09-13
   [$1000][452209495] Medium CVE-2026-0904: Incorrect security UI in Digital

    [11 lines not shown]

   doc: Updated lang/php85 to 8.5.2

   lang/php85: update to 8.5.2

   8.5.2 (2026-01-15)

   15 Jan 2026, PHP 8.5.2

   - Core:
     . Fix OSS-Fuzz #465488618 (Wrong assumptions when dumping function signature
       with dynamic class const lookup default argument). (ilutov)
     . Fixed bug GH-20695 (Assertion failure in normalize_value() when parsing
       malformed INI input via parse_ini_string()). (ndossche)
     . Fixed bug GH-20714 (Uncatchable exception thrown in generator). (ilutov)
     . Fixed bug GH-20352 (UAF in php_output_handler_free via re-entrant
       ob_start() during error deactivation). (ndossche)
     . Fixed bug GH-20745 ("Casting out of range floats to int" applies to
       strings). (Bob)

   - DOM:
     . Fixed bug GH-20722 (Null pointer dereference in DOM namespace node cloning

    [51 lines not shown]

   doc: Updated lang/php83 to 8.3.30

   lang/php83: update to 8.3.30

   8.3.30 (2026-01-15)

   - Core:
     . Fix OSS-Fuzz #465488618 (Wrong assumptions when dumping function signature
       with dynamic class const lookup default argument). (ilutov)
     . Fixed bug GH-20695 (Assertion failure in normalize_value() when parsing
       malformed INI input via parse_ini_string()). (ndossche)
     . Fixed bug GH-20714 (Uncatchable exception thrown in generator). (ilutov)
     . Fixed bug GH-20352 (UAF in php_output_handler_free via re-entrant
       ob_start() during error deactivation). (ndossche)

   - Bz2:
     . Fixed bug GH-20620 (bzcompress overflow on large source size).
       (David Carlier)

   - DOM:
     . Fixed bug GH-20722 (Null pointer dereference in DOM namespace node cloning

    [39 lines not shown]

   doc: Updated lang/php84 to 8.4.17

   lang/php84: update to 8.4.17

   8.4.17 (2025-01-15)

   - Core:
     . Fix OSS-Fuzz #465488618 (Wrong assumptions when dumping function signature
       with dynamic class const lookup default argument). (ilutov)
     . Fixed bug GH-20695 (Assertion failure in normalize_value() when parsing
       malformed INI input via parse_ini_string()). (ndossche)
     . Fixed bug GH-20714 (Uncatchable exception thrown in generator). (ilutov)
     . Fixed bug GH-20352 (UAF in php_output_handler_free via re-entrant
       ob_start() during error deactivation). (ndossche)

   - Bz2:
     . Fixed bug GH-20620 (bzcompress overflow on large source size).
       (David Carlier)

   - DOM:
     . Fixed bug GH-20722 (Null pointer dereference in DOM namespace node cloning

    [47 lines not shown]

chromium: update to 144.0.7559.59

   doc: Updated lang/ruby32 and related pacakges to 3.2.10

        lang/ruby32-base
        devel/ruby-readline
        lang/ruby32

   lang/ruby32-base: update to 3.2.10

   3.2.10 (2026-01-14)

   This release includes the following security fixes:

   * CVE-2025-61594: URI Credential Leakage Bypass previous fixes | Ruby
   * CVE-2025-58767: DoS vulnerability in REXML | Ruby

   and the following fixes for some issues:

   * Build issue of using Ruby 4.0 with BASERUBY at Windows platform
   * Issue with OpenSSL 3.6.0

   What's Changed

   * Backport post_push.yml workflow to ruby_3_2 by k0kubun · Pull Request
     #14771
   * Backport fetch_changesets to ruby_3_2 by k0kubun · Pull Request #14774

    [2 lines not shown]

   fix wrong sizeof char buf used in resolve debug

   no harm caused, as p_time not internally used yet.

   seen by christos@ and riastradh@

   devel/ruby-shoulda-matchers: update distinfo

   Forgot to update distinfo in previous commit.

   Updated security/p11-kit, audio/py-last

   py-last: updated to 7.0.2

   7.0.2

   Fixed

   Fix user playcount for artists
   Create httpx.Client with context manager to fix unclosed socket resource warning
   Fix setting network for country.get_top_artists
   Simplify xml.dom imports

   p11-kit: updated to 0.26.1

   0.26.1 (stable)
   * trust: Ensure compatibility of CKA_NSS_TRUST and CKA_TRUST

   correction as: to -> version, sorry